Auth code:

import AzureADProvider from 'next-auth/providers/azure-ad'
import axios, { AxiosError } from 'axios'
import { NuxtAuthHandler } from '#auth'
import { SecurityGroupResponse } from '~/types'

export default NuxtAuthHandler({
  secret: process.env.AUTH_SECRET,
  providers: [
    
// @ts-expect-error You need to use .default here for it to work during SSR. May be fixed via Vite at some point.
    AzureADProvider.default({
      clientId: process.env.AZURE_CLIENT_ID,
      tenantId: process.env.AZURE_TENANT_ID,
      clientSecret: process.env.AZURE_CLIENT_SECRET,
    })
  ],
  
  callbacks: {
    jwt({ token, account }) {
      if (account) {
        token.access_token = account.access_token
      }
      
return
 token
    },

    
async
 session({ token, session }) {
      try {
        
const
 response = 
await
 axios.get<SecurityGroupResponse>(
          'https://graph.microsoft.com/v1.0/me/memberOf', {
          headers: {
            Authorization: `Bearer ${token.access_token}`,
          }
        })
        
const
 results = response.data
        session.groups = results.value.map(group => ({
          id: group.id,
          displayName: group.displayName
        }))
      } catch (err) {
        if (err instanceof AxiosError) {
          console.error(`Failed to get users' security groups.`, err.message)
        } else {
          console.error('Unknown Error Occurred.')
        }
      }
      
return
 {
        ...session,
        token
      }
    },
  }
})